search

hanford / next-offline

make your Next.js application work offline using service workers via Google's workbox
https://github.com/hanford/next-offline
1.59k stars 113 forks source link

CVE-2021-27290 high severity #279

Open kaaax0815 opened 3 years ago

kaaax0815 commented 3 years ago

The latest possible version that can be installed is 6.0.2 because of the following conflicting dependency:

next-offline@5.0.3 requires ssri@^6.0.1 via a transitive dependency on cacache@12.0.4 The earliest fixed version is 8.0.1

Can I update this myself or will this break?

Or can someone update it?

SalahAdDin commented 3 years ago

@hanford Another more.

hanford commented 3 years ago

I'd accept a pull request, but this isn't currently disrupting my workflow

hanford commented 3 years ago

Maybe this one? https://github.com/hanford/next-offline/pull/282

kaaax0815 commented 3 years ago

this bumps the version to 6.0.2

The earliest fixed version is 8.0.1

meabed commented 2 years ago

Thank you hanford, If this is helpful, I have forked the library and migrated to typescript and updated the deps here https://github.com/meabed/next-offline-ts

SalahAdDin commented 2 years ago

@hanford the idea would be to have that fork improvements on this package, @meabed.

meabed commented 2 years ago

@SalahAdDin Not sure if the author would do that - I appreciate the effort here and I wouldn't mind, but it seems he is not updating the repo anymore. and I had some fixes and updates to do so I had this fork, for now I would keep maintaining it.